QakBot is a worm that spreads through network shares and removable drives. It can download files, steal information off infected machines, open a backdoor on the computer, steal account login credentials, and hide itself. A new form of it, however, has been detected and even after QakBot’s ability to steal data has been removed from an infected machine, this new version recently detected by McAfee lurks in the background and continues to wreak havoc.
Pinkslipbot, as it’s being called, uses infected machines as proxies (or intermediaries) to continue to harvest banking credentials using a variety of methods such as keyloggers, man-in-the-middle attacks, and password stealers. The main targets are U.S. financial institutions. These zombie machines are estimated to be an army of around 500,000 and according to the researchers, steal over half a million records each day.
These bots used by this malware have been found on multiple machines within a single network, both at home and in offices, as well on public WiFi networks.
Drive-by download refers to two differently initiated software downloads from the internet with each leading to the unintentional installation of malware. The first, and most common, happens with people who have authorization to install software, but fall for fake software update pop-ups or other installation notices. Never respond to pop-up ads or notifications. Go directly to the website or access the update from your current application.
The second, and less common but picking up steam, is when software is installed on a computer without a person's permission or knowledge from a malicious website. Websites can be setup as malicious or real websites can be attacked and used to distribute malware without the owner's knowledge. Clicking on ads or email links lead to the majority of infections as the site appears to be legitimite but is installing malware in the background. You only need to visit these sites for a split second to be infected and this is how drive-by got its name. The ad may take you to the malicious site and that site then immediately forwards you to the real site. It happens so fast, people have no idea anything happened. So now the person is visiting the intended site and in the background, malware is being installed. Not clicking is always your safest bet.
Always make sure anti-malware is installed and kept updated on all internet-connected devices you have. This is one of the primary ways to keep wicked little programs like this off your devices and out of your hair.
Because so much malware makes it onto networks, computers, and mobile devices of all types via phishing, be very suspicious of email messages that may be phishing for you to set it loose. This means, if you receive an attachment or link, or even an email message from an unknown sender, see something that is unexpected, and/or just strikes you as a bit strange, don’t click it. Better safe than sorry. If you accidently toss something into your virtual “File 13” that was legitimate, whoever sent it will follow up.
Always be aware that malware such as QakBot and Pinkslipbot are out there and evolving all the time. In fact, although QakBot has been around for over eight years, just before this version was found, another evolution of it was discovered. That one could gain escalated privileges on a network and steal the administrator login credentials.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
